Fixes the following vulnerability:
CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()
libXpm uses a number of internal helper functions to parse the XPM file
format.
One of these internal functions, xpmNextString(), checks for the NULL
terminator when looking for the end of the current string but not when
looking for the beginning of the next string.
A small XPM file with a malformed color table definition may cause the
function xpmNextWord(), called from xpmParseColors() following a call to
xpmNextString(), to start past the actual end of the file, causing an
out-of-bound read.
Advisory:
https://lists.x.org/archives/xorg-announce/2026-April/003690.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3aa75c99c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Backport 2 patches from upstream maintenance branch. Same fixes as
required for gcc-14.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 10ccbe079c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Backport two patches from upstream gcc-14 maintenance branch. Requires
one more patch on top of the fix for gcc-15.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit dee4991cd1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The FRR package currently only installs systemv services files. The
upstream package also provides a systemd service file and a service
template file. Install those when systemd is selected as an init
manager.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 5af981a672)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The __name__ == '__main__' guard allows importing pkg-stats as a
module using importlib, circumventing the normal module filename
requirements. This in turn makes it possible to test/debug individual
functions.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 8cde69e101)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The file handle can be iterated over directly and each line is used
exactly once, so the only effect of reading all lines into a list
first was higher memory use and complexity.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 07f7ad9898)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The filter is supposed to exclude host/target infra from output if the
respective package is not built with the current
configuration.
However, excluding host packages did not work correctly: If keep_host
is False because the host package is not built, the next branch was
checked and included the host infra in output with "target" type if
the target package is built. For a package that support host and
target build, but gets built only for the target, this leads to output
like (Meson example):
meson (target)
host-meson (target)
Skip host infra in the target branch instead. Also include
Package.infra in Package.__str__() result, which was needed for
debugging this bug.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit e8dcebf459)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Use only one of the classes for "error" or "warning" status so they
look different, and format the error/warning text for both. Do not
make the text a link if the URL is None.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7961bd10b9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The previous Config.* glob also caught linux/Config.ext.in and
package/php/Config.ext, as well as some backup files created by
editors (e.g. Config.in~ after editing a Config.in file in Emacs),
leading to wrong results depending on directory listing order.
Also use "with" to automatically close the file when the block is
left, even on error.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 77a464969c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
I don't use maintain x11vnc in buildroot anymore and can't easily test.
Signed-off-by: Martin Kepplinger-Novaković <martink@posteo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81e72115a0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 6558eb3d65)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 34f4732f1a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
OpenSSH checks during ./configure if the default location /var/run
exists on the build host, and defaults to ${sysconfdir} (/etc/ssh in
Buildroot) if not. This can break e.g. in a sandbox with its own mount
namespace where there is no reason to create a /var.
On the target this leads to errors when starting/stopping the service
from the init script, which expects the PID file at /var/run/sshd.pid if
sshd is running. A "stop" (including as part of "restart") or "reload"
will always fail with
no /usr/sbin/sshd found; none killed
from start-stop-daemon, even though sshd is running (because the PID
file doesn't exist where start-stop-daemon tries to read it).
On the other hand, a "start" command will try to start sshd even if it
is already running, because it cannot detect the running instance.
Unfortunately sshd does not fail directly in that situation (so the init
script completes), but something like the following appears in the log:
[May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on 0.0.0.0
failed: Address in use.
[May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on :: failed:
Address in use.
[May 04 14:48:05] auth sshd[4592]: fatal: Cannot bind any address.
Explicitly setting --with-pid-dir=/var/run overrides either default,
and only logs a warning if /var/run does not exist.
[1] 5fa60ae0d2/configure.ac (L5568-L5576)
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: expand commit message after discussion on ML]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit c09bec68f1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Bugfix release fixing crash / NULL pointer access issues and gsasl
authentication compatibility with Microsoft servers.
Mutt 2.2.14 was released on February 20, 2025. This is a bug-fix release,
fixing a couple possible crashes, in GPGME and with IMAP when logging out,
and correcting a small issue with unnecessary encoding of "." in attachment
names (2231 encoding).
Mutt 2.2.15 was released on October 2, 2025. This is a bug-fix release,
fixing an IMAP search/limit bug, a compilation issue, and containing a
workaround for gsasl SMTP authentication issues with some MS servers. A few
parts of the documentation were also improved.
Mutt 2.2.16 was released on November 22, 2025. This is a bug-fix release,
fixing a resource leak when compiled with OpenSSL/LibreSSL, which could
eventually result in new connections failing.
http://www.mutt.org/news.html
The 2.2.16 release is not available on bitbucket, so change to the official
ftp.mutt.org location instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 206cd3cd31)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Bugfix release with large number of (security) fixes.
For 6.2.26:
- a severe issue was found in the compression library (slz) where
specially crafted patterns with tune.bufsize above 17408 or
tune.maxrewrite below 964 (both non-default) could cause output
buffer overflows due to the overhead exceeding the promised
worst-case growth bound of 5 bytes and reach up to 1/16 of the
input contents. Given that the compression output is hardly
controllable, and the canaries at the end of the pools will catch
this at release time, the risk of exploitation by a hostile server
is close to zero, however it will cause repeated crashes if such a
crafted file is present on a server and regularly downloaded. A
workaround consists in keeping tune.maxrewrite at least 1/16 of
tune.bufsize or just not changing them since the defaults are safe.
A CVE was requested two weeks ago for this one, I'll mention it when
it arrives.
- HTTP/2 incomplete transfer detection was missing for HEADERS frames
carrying END_STREAM. When relayed to an HTTP/1.1 server that
responds before the end of the transfer, this can result in bytes
of the next request over the same connection to be ignored. Most of
the time it will cause the connection to be dropped due to an
unparsable request, but when combined with "http-reuse never", or
on totally idle servers, the client could expect the second request
to reuse the same connection and perform a content smuggling attack
that would allow to pass an unverified request to a server. For
those who can't upgrade, a temporary workaround is to disable
HTTP/2 by specifying "alpn http/1.1" on bind lines and adding
"disable-h2-upgrade" in HTTP frontends. A CVE will be requested for
this one.
- HTTP/1.1 bodyless messages announcing a non-null Content-Length did
not force close mode on the backend, potentially causing
desynchronisation between HAProxy and the server in conjunction
with other bugs.
- FCGI record length truncation with large bufsize (>=65544) could
enable request smuggling into PHP-FPM since the 16-bit
content_length field silently truncated to 65535 bytes.
- an unvalidated SNI name_len field in ClientHello could cause OOB
heap reads of up to 65KB via XXH3, smp_dup(), and log-format leaks
on any TCP frontend using req.ssl_sni, possibly causing crashes when
used.
- ECDSA JWT signatures with ES256/384/512 could cause a heap overflow
of ~14 bytes in the DER conversion before verification.
- Lua's httpclient headers conversion accepted more than 101 headers
without bound checking, causing a stack buffer overflow reachable
from any Lua action/task/service.
- peers dictionary cache updates accepted an unvalidated entry id as
array index, allowing OOB heap writes at attacker-controlled
offsets.
- Lua had a use-after-free of HTTP reason strings managed by Lua's GC
between set_status() and start_response(), potentially leaking
adjacent information from memory.
- the regsub sample function could leak ~9-50KB of stale heap data
when back-reference expansion overflowed the output buffer.
- SPOE decode_varint() had no iteration cap, allowing pointer
arithmetic to wrap and dereference memory ~64KB before the
allocation, causing SIGSEGV or parser confusion.
- in sample expressions, less common HTTP methods (PATCH etc.) are
represented by both an enum and a string. The string part was not
handled correctly in sample duplication functions, resulting in
their contents appearing empty when trying to fetch the method.
- QPACK varint decoding is now also limited to 62-bit, and had a risk
of 1-byte OOB reads on truncated streams, which could cause
incorrect header decoding.
- config: a few argument parsing errors in conditional expressions
used in ".if" could be misreported and even cause a crash during
the parsing. Also, a few keywords relying on warnif_misplaced_*
didn't check the return value and didn't count emitted warnings as
warnings.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47016.html
For 6.2.27:
A major issue were fixed by this release. It was related to the scheme-based
normalization. The presence of commas in Host header and authority was permitted
and would be used to compare the values, which then would differ when read via
hdr(host) which splits them on commas, and under certain circumstances, trigger
crashes (at least it did in the OSS-Fuzz environment when injecting the values
directly at the HTX layer). The issue was fixed. Remains the case of the comma
characters in authorities. Even though the spec permits commas in authorities
(not in domain names), there is currently no use case for this and it causes an
ambiguity with the historical use of hdr(host), so we preferred to just deny
them. The change was performed on the 3.4-dev10 and postponed for the next 3.3
release. It will probably be backported to lower versions too.
An issue in the FCGI multiplexer was fixed. The function responsible to emit
FCGI_PARAM records was not handling cases of full buffer in a consistent
way. The issue was quite limited, but the "http-send-name-header" option could
be silently ignored. The issue was fixed by reworking this function.
The scheme-based normalization was fixed to properly handle case of OPTIONS
requests. As stated in RFC9110#4.2.3, when the scheme-based normalization is
performed, an empty path must be normalized to "/", except for OPTIONS request.
Finally, a memory leak on error path (tools) and other minor issues were also
fixed.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47059.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22f1e90d6b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes the following security issues:
- CVE-2026-27654: Buffer overflow in ngx_http_dav_module when using the
alias directive with WebDAV COPY or MOVE requests.
- CVE-2026-27784 & CVE-2026-32647: Buffer overflows in ngx_http_mp4_module
when processing specially crafted MP4 files.
- CVE-2026-27651: NULL pointer dereference in the mail proxy module
during CRAM-MD5 or APOP authentication retries.
- CVE-2026-28753: DNS PTR record manipulation in auth_http or SMTP proxy.
- CVE-2026-28755: OCSP certificate check bypass in the stream module.
For a full list of changes, see:
https://nginx.org/en/CHANGES-1.28
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 8008da299f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
See here for changes:
https://nginx.org/en/CHANGES-1.28
Following security related issues are fixed:
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Security: insufficient check in virtual servers handling with TLSv1.3
SNI allowed to reuse SSL sessions in a different virtual server, to
bypass client SSL certificates verification (CVE-2025-23419).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash
(CVE-2024-7347).
Thanks to Nils Bars.
*) Security: when using HTTP/3, processing of a specially crafted QUIC
session might cause a worker process crash, worker process memory
disclosure on systems with MTU larger than 4096 bytes, or might have
potential other impact (CVE-2024-32760, CVE-2024-31079,
CVE-2024-35200, CVE-2024-34161).
Thanks to Nils Bars of CISPA.
Update patch 0007, which does not apply cleanly.
License file was changed, year was bumped to 2025.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a0081aa1f8)
[thomas: remove previously Cherry picked commit]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
While CVE-2019-6111 was already fixed in 2025.89, the version 2026.90
provided a follow up of that fix.
Note that the author provided this note with this patch:
> Note breaking change: "-r" is now disallowed when the target directory exists
> (an additional change in Dropbear's version). If that's required an alternative
> such as rsync could be used.
Adapt your usage of dropbear accordingly.
- CVE-2019-6111:
An issue was discovered in OpenSSH 7.9. Due to the scp implementation
being derived from 1983 rcp, the server chooses which
files/directories are sent to the client. However, the scp client only
performs cursory validation of the object name returned (only
directory traversal attacks are prevented). A malicious scp server (or
Man-in-The-Middle attacker) can overwrite arbitrary files in the scp
client target directory. If recursive operation (-r) is performed, the
server can manipulate subdirectories as well (for example, to
overwrite the .ssh/authorized_keys file).
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2019-6111
- CVE-2026-35385:
In OpenSSH before 10.3, a file downloaded by scp may be installed
setuid or setgid, an outcome contrary to some users' expectations, if
the download is performed as root with -O (legacy scp protocol) and
without -p (preserve mode).
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-35385
[1] https://github.com/mkj/dropbear/releases/tag/DROPBEAR_2026.90
(cherry picked from commit 5b136c89ff)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- CVE-2026-27448:
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in
version 0.14.0 and prior to version 26.0.0, if a user provided
callback to `set_tlsext_servername_callback` raised an unhandled
exception, this would result in a connection being accepted. If a user
was relying on this callback for any security-sensitive behavior, this
could allow bypassing it. Starting in version 26.0.0, unhandled
exceptions now result in rejecting the connection.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-27448
- d41a814759
- CVE-2026-27459:
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in
version 22.0.0 and prior to version 26.0.0, if a user provided
callback to `set_cookie_generate_callback` returned a cookie value
greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided
buffer. Starting in version 26.0.0, cookie values that are too long
are now rejected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-27459
- 57f09bb4bb
(cherry picked from commit 7bcba8498b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Thanks to OpenEmbedded Community for providing the patches:
https://github.com/openembedded/meta-openembedded/blob/scarthgap/meta-python/recipes-devtools/python/python3-cbor2/
- CVE-2025-64076:
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the
decode_definite_long_string() function of the C extension decoder
(source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds
Read (CWE-191, CWE-125): An incorrect variable reference and missing
state reset in the chunk processing loop causes buffer_length to not
be reset to zero after UTF-8 character consumption. This results in
subsequent chunk_length calculations producing negative values (e.g.,
chunk_length = 65536 - buffer_length), which are passed as signed
integers to the read() method, potentially triggering unlimited read
operations and resource exhaustion. (2) Memory Leak via Missing
Reference Count Release (CWE-401): The main processing loop fails to
release Python object references (Py_DECREF) for chunk objects
allocated in each iteration. For CBOR strings longer than 65536 bytes,
this causes cumulative memory leaks proportional to the payload size,
enabling memory exhaustion attacks through repeated processing of
large CBOR payloads. Both vulnerabilities can be exploited remotely
without authentication by sending specially-crafted CBOR data
containing definite-length text strings with multi-byte UTF-8
characters positioned at 65536-byte chunk boundaries. Successful
exploitation results in denial of service through process crashes
(CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities
affect all applications using cbor2's C extension to process untrusted
CBOR data, including web APIs, IoT data collectors, and message queue
processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9
pushed with released version 5.7.1.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64076
- CVE-2025-68131:
cbor2 provides encoding and decoding for the Concise Binary Object
Representation (CBOR) serialization format. Starting in version 3.0.0
and prior to version 5.8.0, whhen a CBORDecoder instance is reused
across multiple decode operations, values marked with the shareable
tag (28) persist in memory and can be accessed by subsequent CBOR
messages using the sharedref tag (29). This allows an attacker-
controlled message to read data from previously decoded messages if
the decoder is reused across trust boundaries. Version 5.8.0 patches
the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68131
- CVE-2026-26209:
cbor2 provides encoding and decoding for the Concise Binary Object
Representation (CBOR) serialization format. Versions prior to 5.9.0
are vulnerable to a Denial of Service (DoS) attack caused by
uncontrolled recursion when decoding deeply nested CBOR structures.
This vulnerability affects both the pure Python implementation and the
C extension `_cbor2`. The C extension relies on Python's internal
recursion limits `Py_EnterRecursiveCall` rather than a data-driven
depth limit, meaning it still raises `RecursionError` and crashes the
worker process when the limit is hit. While the library handles
moderate nesting levels, it lacks a hard depth limit. An attacker can
supply a crafted CBOR payload containing approximately 100,000 nested
arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits
the Python interpreter's maximum recursion depth or exhausts the
stack, causing the process to crash with a `RecursionError`. Because
the library does not enforce its own limits, it allows an external
attacker to exhaust the host application's stack resource. In many web
application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery),
an unhandled `RecursionError` terminates the worker process
immediately. By sending a stream of these small (<100KB) malicious
packets, an attacker can repeatedly crash worker processes, resulting
in a complete Denial of Service for the application. Version 5.9.0
patches the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-26209
(cherry picked from commit b676a4f51b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
